영향받는 버전 라인
- 1.63 CVE 1건 KEV 1
- 1.62 CVE 1건 KEV 1
- 1.61 CVE 3건 KEV 1
- 1.60 CVE 5건 KEV 1
- 1.59 CVE 6건 KEV 1
- 1.58 CVE 7건 KEV 1
- 1.57 CVE 6건
- 1.56 CVE 5건
- 1.55 CVE 5건
- 1.54 CVE 4건
- 1.53 CVE 4건
- 1.52 CVE 4건
- 1.51 CVE 4건
- 1.50 CVE 4건
- 1.47 CVE 4건
- 1.46 CVE 6건
- 1.45 CVE 8건
- 1.44 CVE 13건
- 1.43 CVE 13건
- 1.42 CVE 16건
- 1.41 CVE 15건
- 1.40 CVE 11건 KEV 1
- 1.0 CVE 8건
- 0.63 CVE 8건 KEV 1
- 0.62 CVE 8건 KEV 1
- 0.61 CVE 9건 KEV 1
- 0.60 CVE 9건 KEV 1
- 0.59 CVE 9건 KEV 1
- 0.58 CVE 9건 KEV 1
- 0.57 CVE 7건
- 0.56 CVE 6건
- 0.55 CVE 6건
- 0.54 CVE 7건
- 0.46 CVE 7건
- 0.45 CVE 9건
- 0.44 CVE 15건
- 0.43 CVE 15건
- 0.42 CVE 18건
- 0.41 CVE 17건
- 0.40 CVE 13건 KEV 1
- 0.29 CVE 11건
알려진 취약점
| CVE | 제목 | 영향 버전 | CVSS | 악용 | EPSS | 공개일 |
|---|---|---|---|---|---|---|
| CVE-2026-72898 | Metabase SQL injection via password reset endpoint | ≥ x.58.0 < x.58.24 ≥ x.59.0 < x.59.21 ≥ x.60.0 < x.60.17 | 10.0 | KEV | 98.2% | 2026-08-10 |
| CVE-2021-41277 | GeoJSON URL validation can expose server files and environment variables to unauthorized users | * = 0.40.0 = 0.40.1 | 7.5 | KEV | 97.2% | 2021-11-17 |
| CVE-2026-103928 | Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions | * | 9.3 | — | 2026-10-14 | |
| CVE-2026-92813 | Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass | ≤ 0.63.18 | 6.9 | — | 2026-09-17 | |
| CVE-2026-86116 | Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API | ≥ 0.57.0 < 0.63.1 | 7.1 | — | 2026-09-05 | |
| CVE-2026-72900 | Metabase information exposure | ≥ x.58.0 < x.58.24 ≥ x.59.0 < x.59.21 ≥ x.60.0 < x.60.17 | 7.1 | — | 2026-08-11 | |
| CVE-2026-72899 | Metabase SQL injection via public card or dashboard | ≥ x.58.0 < x.58.24 ≥ x.59.0 < x.59.21 ≥ x.60.0 < x.60.17 | 10.0 | — | 2026-08-11 | |
| CVE-2026-50148 | Metabase: Remote Code Execution via Snowflake JDBC Driver Arbitrary File Write | * ≥ 1.54.0 < 1.54.24 ≥ 1.55.0 < 1.55.24 | 9.1 | — | 2026-07-15 | |
| CVE-2026-50147 | Metabase: Arbitrary File Read via MySQL Connection Property Injection | * ≥ 1.57.0 < 1.57.19.1 ≥ 1.58.0 < 1.58.14.1 | 7.6 | — | 2026-07-15 | |
| CVE-2026-59826 | Metabase: Arbitrary Code Execution via Database Connection Detail Bypass | * ≥ 1.55.0 < 1.58.15.1 ≥ 1.59.0 < 1.59.12 | 9.1 | — | 2026-07-09 | |
| CVE-2026-59827 | Metabase: Unsafe Deserialization of H2 Query Results | * ≥ 0.58.0 < 0.58.15 ≥ 0.59.0 < 0.59.12 | 8.8 | — | 2026-07-09 | |
| CVE-2026-33725 | Metabase vulnerable to RCE and Arbitrary File Read via H2 JDBC INIT Injection in EE Serialization Import | * < 1.54.22 ≥ 1.55.0 < 1.55.22 | 7.2 | — | 2026-03-27 | |
| CVE-2026-27464 | Metabase: Server-Side Template Injection via Notifications Endpoint Leads to RCE | * < 0.57.13 < 1.57.13 | 6.5 | — | 2026-02-21 | |
| CVE-2026-22805 | Metabase channel test endpoint can reach internal local addresses | * < 0.55.13 < 1.55.13 | 2.1 | — | 2026-01-12 | |
| CVE-2025-5895 | Metabase dom.js parseDataUri redos | = 0.54.10 | 2.1 | — | 2025-06-09 | |
| CVE-2025-32382 | Snowflake credentials logged by the Metabase backend | * | 1.8 | — | 2025-04-10 | |
| CVE-2025-30371 | Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint | * | 2.1 | — | 2025-03-28 | |
| CVE-2025-27141 | Metabase Enterprise Edition allows cached questions to leak data to impersonated users | * ≥ 1.47.0 < 1.50.36 ≥ 1.51.0 < 1.51.14 | 4.8 | — | 2025-02-24 | |
| CVE-2024-55951 | Metabase sandboxed users could see filter values from other sandboxed users | * | 4.8 | — | 2024-12-17 | |
| CVE-2023-37470 | Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint | * < 0.43.7.3 < 1.43.7.3 | 9.8 | — | 2023-08-04 | |
| CVE-2023-38646 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitr... | * < 0.43.7.2 < 1.43.7.2 | 9.8 | — | 2023-07-21 | |
| CVE-2023-32680 | Missing SQL permissions check in metabase | * < 0.44.7 ≥ 0.45.0 < 0.45.4 | 9.6 | — | 2023-05-18 | |
| CVE-2023-23628 | Metabase subject to Exposure of Sensitive Information to an Unauthorized Actor | * < 0.43.7.1 ≥ 0.44.0 < 0.44.6.1 | 4.1 | — | 2023-01-28 | |
| CVE-2023-23629 | Metabase subject to Improper Privilege Management | * < 0.43.7.1 ≥ 0.44.0 < 0.44.6.1 | 6.3 | — | 2023-01-28 | |
| CVE-2022-39362 | Metabase vulnerable to arbitrary SQL execution from queryhash | * ≥ 0.41.0 < 0.41.9 ≥ 0.42.0 < 0.42.6 | 8.8 | — | 2022-10-26 | |
| CVE-2022-39361 | Metabase vulnerable to Remote Code Execution via H2 | * ≥ 0.41.0 < 0.41.9 ≥ 0.42.0 < 0.42.6 | 8.8 | — | 2022-10-26 | |
| CVE-2022-39360 | Metabase SSO users able to circumvent IdP login by doing password reset | * ≥ 0.41.0 < 0.41.9 ≥ 0.42.0 < 0.42.6 | 6.5 | — | 2022-10-26 | |
| CVE-2022-39359 | Metabase's GeoJSON validation doesn't prevent redirects to blocked URLs | * ≥ 0.41.0 < 0.41.9 ≥ 0.42.0 < 0.42.6 | 6.5 | — | 2022-10-26 | |
| CVE-2022-39358 | Metabase vulnerable to circumvention of Locked parameter in Signed Embedding | * ≥ 0.42.0 < 0.42.6 ≥ 0.43.0 < 0.43.7 | 6.5 | — | 2022-10-26 | |
| CVE-2022-43776 | The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side R... | < 0.44.5 | 6.5 | — | 2022-10-26 | |
| CVE-2022-24855 | XSS vulnerability in Metabase | * ≥ 0.40.0 < 0.40.8 ≥ 0.41.0 < 0.41.7 | 5.4 | — | 2022-04-14 | |
| CVE-2022-24854 | Database bypassing any permissions in Metabase via SQlite attach | * ≥ 0.41.0 < 0.41.7 ≥ 0.42.0 < 0.42.4 | 8.8 | — | 2022-04-14 | |
| CVE-2022-24853 | File system exposure in Metabase | * ≥ 0.40.0 < 0.40.8 ≥ 0.41.0 < 0.41.7 | 5.3 | — | 2022-04-14 | |
| CVE-2018-0697 | Cross-site scripting vulnerability in Metabase version 0.29.3 and earlier allows remote attackers to inject ar... | ≤ 0.29.3 | 6.1 | — | 2018-11-15 |
내 서버의 버전을 직접 추적하세요
InfraGuard 는 모든 서버에 설치된 소프트웨어 버전을 수집하고, 알려진 취약점이 있는 버전을 알려 줍니다. 자체 호스팅이라 데이터가 내 네트워크를 벗어나지 않습니다.
데이터: CVE List(CVE® Program), NVD, CISA KEV, FIRST EPSS(EPSS 는 https://www.first.org/epss 참고), endoflife.date. 소프트웨어 목록: awesome-selfhosted(CC BY-SA 3.0).